# Deposit transactions lose funds to front-running when multiple fee tiers are available

Multipool deposit lacked a minimum-LP-token slippage check, letting an attacker sandwich across two fee tiers to overinflate reserves and mint the depositor far fewer LP tokens.

- Payout: Contest reward
- Severity: high
- Program: Real Wagmi
- Credited: crimson-rat-reach
- Disclosed: 2023-06-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-06-real-wagmi-judging/issues/105
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Multipool deposit/mint function in Solidity AMM concentrator
**Root cause:** Deposit only enforces amount0Min/amount1Min on the input tokens, not a minimum LP-token output; _optimizeAmounts balances amounts across fee tiers so the min checks pass even when reserves are inflated and the LP ratio collapses.
**Steps:**
1. Alice submits deposit with (amount0Desired, amount0Min) > (amount1Desired, amount1Min)
2. Bob front-runs: swap to make tokenA cheap in feeTier1 (pool holds lots of tokenA)
3. Bob swaps opposite direction in feeTier2 to make tokenB cheap (pool holds lots of tokenB)
4. Reserves across fee tiers become balanced but overinflated; `_optimizeAmounts` returns amounts satisfying amount0Min/amount1Min
5. LP minted via `l0=(amount0Desired*totalSupply)/reserve0`, `l1=(amount1Desired*totalSupply)/reserve1`, min(l0,l1) is far smaller than fair
6. Bob back-runs to restore prices and captures the difference
**How found:** Code review of the deposit path: noticed no minimum-LP-token parameter, only input-token minimums; reasoned that with multiple fee tiers an attacker can inflate both reserves simultaneously so the min checks still pass while the LP ratio shrinks.
**Exploitation:** Sandwich: front-run swaps across two UniswapV3 fee tiers to inflate both reserves, let victim deposit at the manipulated ratio minting fewer LP tokens, then back-run to unwind swaps and profit at the depositor's expense.
**Insight:** When a deposit mints shares from a ratio of reserves, check whether the user can bound the *output* (shares) not just inputs; multi-pool/multi-fee-tier designs let an attacker inflate both sides of the ratio at once, defeating per-token minimum checks.